shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-04 02:02:28 +09:00
Code Issues Packages Projects Releases Wiki Activity

mctp i2c: Fix potential use-after-free

Browse Source 
The skb is handed off to netif_rx() which may free it.
Found by Smatch.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Matt Johnston <matt@codeconstruct.com.au>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Matt Johnston
2022-02-25 13:39:37 +08:00
committed by Jakub Kicinski
parent f62457df5c
commit 06bf1ce69d
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/net/mctp/mctp-i2c.c
View File

@@ -338,7 +338,7 @@ static int mctp_i2c_recv(struct mctp_i2c_dev *midev)
if (status == NET_RX_SUCCESS) {
ndev->stats.rx_packets++;
ndev->stats.rx_bytes += skb->len;
ndev->stats.rx_bytes += recvlen;
} else {
ndev->stats.rx_dropped++;
}